Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:113026
MIME-Version: 1.0
References: <CAG9XoMQQLEWQABqy+cMzCcs_EeST5AQT2XxDwuK7EXDgVSQb0A@mail.gmail.com>
 <CAAyV7nGdUB7oNdjGdKSBEtZHOyoKnfgJNp8TXzV7fCFV0KsgQA@mail.gmail.com>
 <CAES=RMvWUkiRS89V4v0_TEmtq7HD0XLXb+xfOoyOQKYL2r8U2g@mail.gmail.com>
 <CADyq6sLY0aAB+=bk5Md7nXADF8H3Trd_7FB2tJNTFAzR6CLvKQ@mail.gmail.com> <CAG9XoMQFt_+U8srKQ6O=yy_yjQSFb3w=0s8K-4frjhpM4qSr8A@mail.gmail.com>
In-Reply-To: <CAG9XoMQFt_+U8srKQ6O=yy_yjQSFb3w=0s8K-4frjhpM4qSr8A@mail.gmail.com>
Date: Sat, 30 Jan 2021 17:05:30 +0100
Message-ID: <CAJmy8YHo1Yp8dU11hHxvqnQREirY9rQbgonHxGhoaaqa6+behQ@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000e104df05ba204a35"
Subject: Re: [PHP-DEV] password_verify() and unknown algos
From: divinity76@gmail.com (Hans Henrik Bergan)

--000000000000e104df05ba204a35
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

PASSWORD_THROW_ON_ERROR

password_verify ( string $password , string $hash, int $flags =3D 0 ) : boo=
l

On Fri, 29 Jan 2021 at 16:01, Benjamin Morel <benjamin.morel@gmail.com>
wrote:

> Hi all, thanks for the constructive feedback.
>
> On Fri, 29 Jan 2021 at 15:52, Marco Pivetta <ocramius@gmail.com> wrote:
>
> >
> > Gonna be the usual person saying: let's not clutter functions with more
> > behavior than what's needed :-)
> >
> > If you need to validate a hash for being "well formed" rather than
> > "matching", then write a separate function dedicated to that, rather th=
an
> > increasing the complexity of a pre-existing symbol.
> >
> > Marco Pivetta
>
>
> I would definitely vote for that, too. It feels to me like throwing an
> exception on invalid algo / malformed hash should be the default behaviou=
r,
> and that the use case brought up by Anthony, although very relevant, shou=
ld
> be the one that should test for validity using another function (or pass =
an
> extra parameter).
>
> That being said, it's indeed a BC break. Would it be small enough to be
> allowed to hit 8.1? I don't know.
>
> =E2=80=94 Benjamin
>

--000000000000e104df05ba204a35--